Cisco ASA 5505 防火墙常用配置案例

interface Vlan2nameif outside --------------------对端口命名外端口security-level 0 --------------------设置端口等级ip address X.X.X.X 255.255.255.224 --------------------调试外网地址!interface Vlan3nameif inside --------------------对端口命名内端口security-level 100 --------------------调试外网地址ip address 192.168.1.1 255.255.255.0 --------------------设置端口等级!interface Ethernet0/0switchport access vlan 2 --------------------设置端口VLAN与VLAN2绑定!interface Ethernet0/1switchport access vlan 3 --------------------设置端口VLAN与VLAN3绑定!interface Ethernet0/2shutdown!interface Ethernet0/3shutdown!interface Ethernet0/4shutdown!interface Ethernet0/5shutdown!interface Ethernet0/6shutdown!interface Ethernet0/7shutdown!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passivedns domain-lookup insidedns server-group DefaultDNSname-server 211.99.129.210name-server 202.106.196.115access-list 102 extended permit icmp any any ------------------设置ACL列表（允许ICMP全部通过）access-list 102 extended permit ip any any ------------------设置ACL列表（允许所有IP全部通过）pager lines 24mtu outside 1500mtu inside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interface ------------------设置NAT地址映射到外网口nat (inside) 1 0.0.0.0 0.0.0.0 ------------------NAT地址池（所有地址）access-group 102 in interface outside ------------------设置ACL列表绑定到外端口route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 ------------------设置到外网的默认路由timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absoluteno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstarttelnet 0.0.0.0 0.0.0.0 inside ------------------设置TELNET所有地址进入telnet timeout 5ssh 0.0.0.0 0.0.0.0 outside ------------------设置SSH所有地址进入ssh timeout 30ssh version 2console timeout 0!dhcpd address 192.168.1.100-192.168.1.199 inside ------------------设置DHCP 服务器地址池dhcpd dns 211.99.129.210 202.106.196.115 interface inside ------------------设置DNS服务器到内网端口dhcpd enable inside ------------------设置DHCP应用到内网端口!前几天去客户那调试CISCO-ASA-5505设备,第一次摸,跟PIX一样,呵呵.没有技术含量,都是最基本的.其他业务配置暂时没配,会及时更新的.Cisco ASA5505配置cisco, config, telnet, 防火墙, Cisco1.配置防火墙名ciscoasa> enableciscoasa# configure terminalciscoasa(config)# hostname asa55052.配置telnetasa5505(config)#telnet 192.168.1.0 255.255.255.0 inside ↑//允许内部接口192.168.1.0网段telnet防火墙3.配置密码asa5505(config)# password cisco ------------------远程密码asa5505(config)# enable password cisco ------------------特权模式密码4.配置IPasa5505(config)# interface vlan 2 ------------------进入vlan2asa5505(config-if)# ip address 218.16.37.222 255.255.255.192 ------------------vlan2配置IPasa5505(config)#show ip address vlan2 ------------------验证配置5.端口加入vlanasa5505(config)# interface e0/3 ------------------进入接口e0/3asa5505(config-if)# switchport access vlan 3 ------------------接口e0/3加入vlan3asa5505(config)# interface vlan 3 ------------------进入vlan3asa5505(config-if)# ip address 10.10.10.36 255.255.255.224 ------------------vlan3配置IPasa5505(config-if)# nameif dmz ------------------vlan3名asa5505(config-if)# no shutdown ------------------开启asa5505(config-if)# show switch vlan ------------------验证配置6.最大传输单元MTUasa5505(config)#mtu inside 1500 ------------------inside最大传输单元1500字节asa5505(config)#mtu outside 1500 ------------------outside最大传输单元1500字节asa5505(config)#mtu dmz 1500 ------------------dmz最大传输单元1500字节7.配置arp表的超时时间asa5505(config)#arp timeout 14400 ------------------arp表的超时时间14400秒8.FTP模式asa5505(config)#ftp mode passive ------------------FTP被动模式9.配置域名asa5505(config)#domain-name 10.启动日志asa5505(config)#logging enable ------------------启动日志asa5505(config)#logging asdm informational ------------------启动asdm报告日志asa5505(config)#Show logging ------------------验证配置11.启用http服务asa5505(config)#http server enable ------------------启动HTTP server,便于ASDM连接。

asa5505(config)#http 0.0.0.0 0.0.0.0 outside ------------------对外启用ASDM连接asa5505(config)#http 0.0.0.0 0.0.0.0 inside ------------------对内启用ASDM连接12.控制列表access-list acl_out extended permit tcp any any eq www ------------------允许tcp协议80端口入站access-list acl_out extended permit tcp any any eq https ------------------允许tcp协议443端口入站access-list acl_out extended permit tcp any host 218.16.37.223 eq ftp↑//允许tcp协议21端口到218.16.37.223主机access-list acl_out extended permit tcp any host 218.16.37.224 eq 3389↑//允许tcp协议3389端口到218.16.37.224主机access-list acl_out extended permit tcp any host 218.16.37.225 eq 1433↑//允许tcp协议1433端口到218.16.37.225主机access-list acl_out extended permit tcp any host 218.16.37.226 eq 8080↑//允许tcp协议8080端口到218.16.37.226主机asa5505(config)#show access-list ------------------验证配置13.设置路由asa5505(config)#route dmz 10.0.0.0 255.0.0.0 10.10.10.33 1↑//静态路由到10.0.0.0网段经过10.10.10.33网关跳数为1asa5505(config)#route outside 0.0.0.0 0.0.0.0 218.16.37.193 1↑//默认路由到所有网段经过218.16.37.193网关跳数为1asa5505# show route ------------------显示路由信息14.静态NATasa5505(config)# static (inside,outside) 218.16.37.223 192.168.1.6 netmask 255.255.255.255↑//外网218.16.37.223映射到内网192.168.1.6asa5505(config)#access-list acl_out extended permit icmp any any↑//控制列表名acl_out允许ICMP协议asa5505(config)#access-group acl_out in interface outside↑//控制列表acl_out应用到outside接口asa5505(config)#static (inside,dmz) 10.10.10.37 192.168.1.16 netmask 255.255.255.255 ↑//dmz10.10.10.37映射到内网192.168.1.16asa5505(config)#access-list acl_dmz extended permit icmp any any↑//控制列表名acl_dmz允许ICMP协议asa5505(config)#access-group acl_dmz in interface dmz -----------------控制列表acl_out应用到dmz接口asa5505(config)#Show nat ------------------验证配置15.动态NATasa5505(config)#global(outside) 1 218.201.35.224-218.201.35.226 ------------------定义全局地址池asa5505(config)#nat(inside) 1 192.168.1.20-192.168.1.22 ------------------内部转换地址池asa5505(config)# show xlate ------------------验证配置16.基于端口NAT（PAT）asa5505(config)#global (outside) 2 interface ----------------定义全局地址即outside地址：218.16.37.222asa5505(config)#nat (inside) 2 192.168.1.0 255.255.255.0 ------------------内部转换地址池asa5505(config)# show xlate ------------------验证配置17.基于LAN故障倒换（failover）1).主防火墙配置asa5505(config)#failover mac addr outside 001a.2b3c.4d11 001a.2b3c.4w12----故障倒换虚拟MAC地址asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w22-----故障倒换虚拟MAC地址asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w32-----故障倒换虚拟MAC地址asa5505(config)#failover ------------------启动故障倒换asa5505(config)#failover lan unit primary ------------------设置主要防火墙asa5505(config)#failover lan interface standby Vlan4 ------------------故障倒换接口名standby asa5505(config)#failover interface ip standby 172.168.32.1 255.255.255.252 standby 172.168.32.2↑//配置主防火墙IP：172.168.32.1,备用防火墙IP：172.168.32.2asa5505# show failover ------------------验证配置2).备防火墙配置asa5505(config)#failover mac addr outside 001a.2b3c.4d11 001a.2b3c.4w12----故障倒换虚拟MAC地址asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w22------故障倒换虚拟MAC地址asa5505(config)#failover mac addr inside 001a.2b3c.4d21 001a.2b3c.4w32------故障倒换虚拟MAC地址asa5505(config)#failover ------------------启动故障倒换asa5505(config)#failover lan unit secondary ------------------设置备用防火墙asa5505(config)#failover lan interface standby Vlan4 ------------------故障倒换接口名standby asa5505(config)#failover interface ip standby 172.168.32.1 255.255.255.252 standby 172.168.32.2↑//配置主防火墙IP：172.168.32.1,备用防火墙IP：172.168.32.2asa5505# show failover ------------------验证配置18.显示mac地址asa5505# show switch mac-address-table19.保存配置asa5505# write memoryCisco ASA 5505防火墙地址映射问题解决前些天帮朋友配置一台Cisco ASA5505防火墙, 映射总是不成功. 在网上也看到很多朋友遇到了这种问题,都在寻问这个解决方法.有人已经将问题解决了,但没给出解决方案. 也许这并不是一个很复杂的难题,但我希望通过博客能帮助朋友们及时得到这个小问题的处理.基本情况:WAN: 221.221.147.195 Gateway: 221.221.147.200 LAN: 192.168.0.1内网中有一台服务器,地址: 192.168.0.10 端口: 8089故障描述: 内网可正常连接至服务器,外网无法连接. 端口映射出现问题.解决方法: 命令行错误, 已更正并解决.问题重点: 采用"static (inside,outside) 221.221.147.195 192.168.0.10 tcp 8089" 映射.目前配置如下:ASA Version 7.2(2)!hostname ciscoasaenable password 8Ry2YjIyt7RRXU24 encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.0.1 255.255.255.0!interface Vlan2nameif outsidesecurity-level 0ip address 221.221.147.195 255.255.255.252!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passiveaccess-list 101 extended permit tcp any host 221.221.147.195 eq 8089access-list 101 extended permit icmp any anyaccess-list 101 extended permit tcp any anyaccess-list 101 extended permit udp any anypager lines 24logging asdm informationalmtu inside 1500mtu outside 1500icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interfacestatic (inside,outside) 221.221.147.195 192.168.0.10 netmask 255.255.255.255 tcp 8089 0 access-group 101 in interface outsideroute outside 0.0.0.0 0.0.0.0 221.221.147.200 1timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout uauth 0:05:00 absolutehttp server enableno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstarttelnet timeout 5ssh timeout 5console timeout 0dhcpd auto_config outside!!class-map inspection_defaultmatch default-inspection-traffic!policy-map type inspect dns preset_dns_mapparametersmessage-length maximum 512policy-map global_policyclass inspection_defaultinspect dns preset_dns_mapinspect ftpinspect h323 h225inspect h323 rasinspect rshinspect rtspinspect esmtpinspect sqlnetinspect skinnyinspect sunrpcinspect xdmcpinspect sipinspect netbiosinspect tftp!service-policy global_policy globalprompt hostname contextCryptochecksum:30e219cbc04a4c919e7411de55e14a64: endciscoasa(config)#------------------------------------------------------------在找寻解决方案过程中,有朋友做了重要提示, 采用: static (inside,outside) int 192.168.0.10 tcp 8089 做映射,但出现警告提示:WARNING: static redireting all traffics at outside interface;WARNING: all services terminating at outside interface are disabled.后来将命令改成: static (inside,outside) 221.221.147.195 192.168.0.10 tcp 8089 问题解决.ASA5505配置笔记ASA5505配置笔记1.IP地址配置<config>#int vlan1<config-if>#>nameif outside<config-if>#security-level 0<config-if>#ip address 172.16.1.1 255.255.0.0.<config-if>#end<config>#int vlan 2<config-if>#nameif insiede<config-if>#security-levlel 100<config-if>#ip address 192.168.1.1 255.255.255.0<config-if>#end2.把端口指定到相应VLAN中<config>#int Eth0/0<config-if>#switchport access vlan 1<config-if>end<config>#int Eth0/1<config-if>switchport access vlan 2<config-if>end<config>#exit3.配置Http.telnet和ssh管理<config>#username xxx password xxxxxx encrypted privilege 15<config>#aaa authentication enable console LOCAL<config>#aaa authentication telnet console LOCAL<config>#aaa authentication http console LOCAL<config>#aaa authentication ssh console LOCAL<config>#aaa autoentication command LOCAL<config>#http server enable<config>#http 192.168.1.0 255.255.255.0 inside<config>#telnet 192.168.1.0 255.255.255.0 inside<config>#ssh 192.168.1.0 255.255.255.0 inside<config>#crypto key generate rsa(打开SSH服务)4.VPN配置VPN配置可在ASDM模式下配置,具体配置略CISCO ASA 5510实际配置案例及详解去年卖个某大型企业的ASA5510防火墙，附实际的配置，并且都解释了得很清楚，非常值得参考的资料！2008-12-15 11:07ASA5510# SHOW RUN: Saved:ASA Version 7.0(6)!hostname ASA5510enable password 2KFQnbNIdI.2KYOU encryptednamesdns-guard!interface Ethernet0/0 此接口为外部网络接口nameif outside 设置为OUTSIDE 外部接口模式security-level 0 外部接口模式安全级别为最高0ip address 192.168.3.234 255.255.255.0 添加外部IP地址（一般为电信÷网通提供）!interface Ethernet0/1此接口为内部网络接口nameif inside设置为INSIDE内部接口模式security-level 100内部接口模式安全级别为100ip address 10.1.1.1255.255.0.0添加内部IP地址（一般为公司自行分配）!interface Ethernet0/2 没用到SHUTDOWN关闭shutdownno nameifno security-levelno ipaddress!interface Management0/0没用到SHUTDOWN 关闭nameifmanagementsecurity-level 100ip address 192.168.1.1 255.255.255.0没用，用网线连接管理的端口。